]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/acme/autogeree.net.nix
mermet: unbound: provide a DNS cache for iodine users
[sourcephile-nix.git] / hosts / mermet / acme / autogeree.net.nix
1 { pkgs, lib, config, ... }:
2 let
3 domain = "autogeree.net";
4 inherit (config.users) users groups;
5 in
6 {
7 networking.nftables.ruleset = ''
8 # for lego to check DNS propagation on ns6.gandi.net
9 add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
10 add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
11 add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
12 add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
13 # for lego to check DNS propagation on ns0.muarf.org
14 add rule inet filter fw2net ip daddr 78.192.65.63 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS muarf"
15 add rule inet filter fw2net ip daddr 78.192.65.63 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS muarf"
16 '';
17 systemd.services."acme-${domain}".after = [
18 "unbound.service"
19 ];
20 security.acme.certs."${domain}" = {
21 email = "root+letsencrypt@${domain}";
22 extraDomainNames = [
23 "*.${domain}"
24 ];
25 group = groups."acme".name;
26 keyType = "rsa4096";
27 dnsProvider = "rfc2136";
28 credentialsFile = pkgs.writeText "credentials" ''
29 RFC2136_NAMESERVER=127.0.0.1:5353
30 RFC2136_PROPAGATION_TIMEOUT=1000
31 RFC2136_POLLING_INTERVAL=30
32 RFC2136_SEQUENCE_INTERVAL=30
33 RFC2136_DNS_TIMEOUT=1000
34 RFC2136_TTL=1
35 '';
36 };
37 }